Question

Your team deploys an application to Azure using GitHub Actions. Security has mandated that no long-lived cloud credentials may be stored as GitHub secrets. You need the workflow to authenticate to Azure to run deployment steps while satisfying this requirement with the least ongoing maintenance. What should you implement?

Accepted Answer

Create an Azure AD app registration with a federated credential configured for the repository/environment, and use OpenID Connect (OIDC) with the azure/login action's client-id, tenant-id, and subscription-id inputs.

Answer

Generate a service principal with a client secret and store the secret in a GitHub Actions secret, rotating it monthly with a scheduled workflow.

Answer

Store an Azure storage account access key in an encrypted GitHub secret and reference it in the azure/login action.

Answer

Use a personal access token (PAT) from an admin account and pass it to the Azure CLI login command in the workflow.